Is CVE-2018-19352 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-19352 being exploited in the wild.

How severe is CVE-2018-19352?

Low severity, with a CVSS score of 3, published 18 November 2018.

Which products and versions are affected?

Project Jupyter Notebook before 5.7.2; notebook (PyPI) GIT:introduced=0,fixed=288b73e1edbf527740e273fcc69b889460871648|ECOSYSTEM:introduced=0,fixed=5.7.2.

Is there a fix for CVE-2018-19352?

Yes. notebook (PyPI): upgrade to 5.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2018-19352 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2018-19352?

Check whether you run Project Jupyter Notebook or notebook (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-19352: Jupyter Notebook XSS via directory name

CVE-2018-19352 · Severity: low · CVSS 3 · Published 2018-11-18

Jupyter Notebook is a popular web-based interactive computing environment used by data scientists and developers. An attacker can inject malicious scripts by creating directories with crafted names that are improperly handled by the notebook interface, allowing them to steal session tokens or perform actions on behalf of users viewing the notebook.

Technologies: Project Jupyter Notebook, notebook (PyPI). Vendors: Project Jupyter, PyPI.

Quick answers

Is CVE-2018-19352 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-19352 being exploited in the wild.
How severe is CVE-2018-19352?: Low severity, with a CVSS score of 3, published 18 November 2018.
Which products and versions are affected?: Project Jupyter Notebook before 5.7.2; notebook (PyPI) GIT:introduced=0,fixed=288b73e1edbf527740e273fcc69b889460871648|ECOSYSTEM:introduced=0,fixed=5.7.2.
Is there a fix for CVE-2018-19352?: Yes. notebook (PyPI): upgrade to 5.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-19352 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2018-19352?: Check whether you run Project Jupyter Notebook or notebook (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

notebook (PyPI): upgrade to 5.7.2 or later
```
pip install "notebook>=5.7.2"
```

Technical details

A cross-site scripting (XSS) vulnerability exists in Jupyter Notebook versions before 5.7.2 in the notebook/static/tree/js/notebooklist.js file, which handles directory URLs unsafely. The vulnerable code fails to properly sanitize or escape user-controlled input (directory names) before inserting them into the DOM. An attacker can craft a directory name containing JavaScript payloads that will be executed in the browser of any user accessing the notebook. The attack requires user interaction (victim must access the crafted directory via a link or navigate to it), but can affect multiple users on the same notebook server. The vulnerability was patched in version 5.7.2.

Affected products

Project Jupyter Notebook before 5.7.2

Identifiers

CVE-2018-19352
GHSA-3p4q-x8f3-p7vq
PYSEC-2018-18

Timeline

2018-11-21: disclosed
2018-11-21: patched: Patched in version 5.7.2

References

https://github.com/jupyter/notebook/commit/288b73e1edbf527740e273fcc69b889460871648

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.